CYBER RISK & LAW

Landmine 4

Cyber Risk Updates


CCPA Landmine No 4


Documentation of your Methodology in Calculating the Value of Data

The law allows a business to offer incentives in exchange for consumer data provided the incentive is “reasonably related to the value provided to the consumer”. But, determining the value of data is hardly a simple exercise.

- In fact, the draft regulations state that “the value provided to the consumer by the consumer’s data. . .is the value provided to the business by the consumer’s data.“ Thus, while the statute states that the price differential must be related to the value provided to the customer, the regulations flip that on its head by equating value to the consumer with value to the business.

- The value of data to a business varies according to how much data is available for sale. (The more data about the consumer, the greater the value). But it’s unlikely that such “market value” is what the legislature intended when it passed the CCPA. The value of my data to me will be far different from the value calculated by a business that just wants to sell it to advertisers and brokers.

- The regulations require businesses to document their reasonable and good faith methods for calculating the value of a consumer data and provides eight proposed methodologies for establishing the value. But it’s unlikely that there will be consensus regardless of the AG’s efforts to offer guidance. Be prepared for privacy rights activists to challenge these methodologies as being unjust, unreasonable, coercive or usurious.

BACK